<?php
/**
* phpCan - http://idc.anavallasuiza.com/
*
* phpCan is released under the GNU Affero GPL version 3
*
* More information at license.txt
*/

namespace data\formats;

defined('ANS') or die();

class Html extends Formats implements iFormats {
	var $format = 'html';

	public function check ($value) {
		$this->error = array();

		return $this->validate($value);
	}

	public function valueForm ($value) {
		return array(
			'' => str_replace("\n", '', $value[''])
		);
	}

	public function valueDB (\data\Data $Data, $value, $language = '', $id = 0) {
		return array(
			'' => $this->xssClean($value[''])
		);
	}


	/**
	 * protected function xssClean ($text)
	 *
	 * return text
	 */
	private function xssClean ($text) {
		// Fix entities;
		$text = str_replace(array('&amp;','&lt;','&gt;'), array('&amp;amp;','&amp;lt;','&amp;gt;'), $text);
		$text = preg_replace('/(&#*\w+)[\x00-\x20]+;/u', '$1;', $text);
		$text = preg_replace('/(&#x*[0-9A-F]+);*/iu', '$1;', $text);
		$text = html_entity_decode($text, ENT_COMPAT, 'UTF-8');

		// Remove any attribute starting with "on" or xmlns
		$text = preg_replace('#(<[^>]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*+>#iu', '$1>', $text);

		// Remove javascript: and vbscript: protocols
		$text = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2nojavascript...', $text);
		$text = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $text);
		$text = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $text);

		// Only works in IE: <span style="width: expression(alert('Ping!'));"></span>
		$text = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i', '$1>', $text);
		$text = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i', '$1>', $text);
		$text = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu', '$1>', $text);

		// Remove namespaced elements (we do not need them)
		$text = preg_replace('#</*\w+:\w[^>]*+>#i', '', $text);

		// Strip multi-line comments
		$text = preg_replace('#<![\s\S]*?–[ \t\n\r]*>#', '', $text);

		do {
			// Remove really unwanted tags
			$old_text = $text;
			$text = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $text);
		} while ($old_text !== $text);

		return $text;
	}

	public function settings ($settings) {
		$this->settings = $this->setSettings($settings, array(
			'' => array(
				'db_type' => 'text',

				'length_max' => '',
			)
		));

		return $this->settings;
	}
}
?>